(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

0
votes
2answers
55 views

Why not put MAC in fixed position and cover padding for MAC-then-encrypt?

The biggest problem with using MtE with a mode where it's known to be secure (CBC) is with the padding, where you can't retrieve the authentication until you know where it is by looking at the padding ...
1
vote
1answer
41 views

How is wpa2 authentication structured

I would like to understand the cryptography behind Wpa2. As far as I know, there are 4 messages on the 4-way handshake and three of them are values concatenated with hashes. First, I am trying to ...
-1
votes
1answer
131 views

Attacking both authenticity and secrecy in authenticated encryption modes

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available. Is that possible a weakness in $GHASH$ compromise ...
3
votes
0answers
95 views

HMAC definition by using only one key

Suppose $H$ is a hash function; why is $H(k||H(k||m))$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $H(k_1 ||H(k_2 ||m))$ . Why don't we use ...
2
votes
0answers
73 views

Using same key for encryption and ECBC-MAC k2

ECBC-MAC: $E_{k_2}(CBC-MAC_{k_1}(m))$ If we use same key for encryption (CTR or CFB) and k2 (end tag encryption) in ECBC-MAC in encrypt-than-MAC sheme, is it secure?
2
votes
0answers
141 views

Regular MACs vs Carter-Wegman MAC

Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc). ...
1
vote
0answers
33 views

Why does OMAC2 exist?

The specification for OMAC has the following to say about OMAC2: For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute ...
1
vote
0answers
64 views

chacha20-poly1305 padding and length encoding

The AEAD construction for chacha20-poly1305 described in the IETF proposal [1] encodes message lengths into the text that is to be hashed. The newer proposal [2] goes further and pads associated data ...
1
vote
0answers
72 views

Performing HMAC with random key before MAC comparison

In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the ...
1
vote
0answers
39 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
1
vote
0answers
128 views

CBC MAC and DES combined question?

Suppose that we want to develop a MAC scheme which is as secure as Triple-DES CBC-MAC and at the same time as efficient as Single-DES CBC-MAC. We come up with the following idea: Except the last ...
1
vote
0answers
146 views

Security of .net AES implementation and security of a hash MAC

My question rather splits into two sections: Is AES correctly and security implemented in the .net Framework? Are there any reviews of implementation mistakes that would weaken the security of AES ...
0
votes
0answers
79 views

Which of these is a secure MAC?

Let (S,V) be a secure MAC defined over $(K,M,T)$ where $M = \{0,1\}^n$ and $T =\{0,1\}^{128}$. Which of the following is a secure MAC: $S'(k,m) = S(k,m)[0,\ldots,126]\quad and \quad V'(k,m,t) = ...
0
votes
0answers
88 views

Security of basic SHA256 MAC in an authenticate-then-encrypt scheme

I know the following construct is insecure if the MAC as defined below is appended to the encrypted message in an Encrypt then Authenticate (EtA) scheme. $k_1$: encryption key $k_2$: authentication ...